Instant, secure tunnels to localhost.
Expose your local development server through a public HTTPS URL. Perfect for webhooks, demos, and mobile app testing.
No credit card required · Free plan forever
# expose your local app on port 8080
$ tunnels http 8080
Authenticated as you@dev
Tunnel established
Forwarding https://app.tunnels.host → localhost:8080
Press Ctrl+C to quit · ▍
Built for developers
A single command exposes any local port. Custom subdomains, basic auth, request inspection, and a real-time web UI on :4040.
Secure by default
Every tunnel is TLS 1.3 end to end. Bring your own domain with automatic certificates, or use a managed *.tunnels.host URL.
Fast & reliable
A lightweight Rust client and a hardened Go edge. Auto-reconnect, per-plan rate limits, and bandwidth metering built in.
What tunnels.io actually does
Your development server is listening on a port on your own machine. Nothing on the internet can reach it, because your router, your ISP or your office firewall will not accept an inbound connection to a laptop. That is not a bug in your setup; it is how home and office networks are built.
tunnels.io works around it by turning the direction around. The client on your machine opens an outbound connection to our edge, which is the one kind of connection that is almost never blocked. The edge takes a public HTTPS address, accepts requests from anyone, and forwards them back down the connection your machine already opened. Replies travel the same way. You open no ports, you change no router settings, and you need no static IP.
That shape has a name: a reverse tunnel. It is worth understanding, because it explains both what the service can do and what it cannot. There is a plain explanation in how a reverse tunnel works, and a broader one in what tunneling means.
What people build with it
The same mechanism, nine different jobs. Each one has its own page with the commands, the limits and the plan you need.
Webhook development
Stripe, GitHub, Shopify and Twilio all need a public HTTPS endpoint. Point them at your laptop and watch every delivery arrive.
Real-device testing
A phone on cellular cannot see your machine. Give your API an address it can reach from any network.
Preview URLs in CI
A reachable URL for every pull request, for end-to-end tests and for the reviewer who wants to click something.
SSH access
Reach an SSH server on a machine with no public address, without touching the router in front of it.
Database access
Hand a teammate a connection string to the Postgres, MySQL or Redis running on your own machine.
Remote desktop
RDP or VNC into a machine that has no public address and no port forward.
Homelab and self-hosting
Your ISP put you behind CGNAT and will not give you a port. An always-on tunnel does not need one.
IoT and embedded
A device on a customer's network you will never have access to. There are armv7 and arm64 builds for exactly this.
Minecraft (Java)
Friends join a server running at your house without a router change. Java Edition is TCP, so it works.
Up and running in 30 seconds
Install the CLI, drop in your token, and forward a port. That's the whole thing.
Install
Authenticate
Tunnel
HTTP and TCP, and what that means
There are two kinds of tunnel. An HTTPS tunnel gives a web server a public address with a certificate already in place, and it is available on every plan including the free one. A raw TCP tunnel forwards bytes without caring what protocol they are, which is what you need for SSH, for remote desktop, for Postgres, Redis and MySQL, and for a Minecraft Java server. Raw TCP starts on the Professional plan at $4 a month.
What we do not carry is UDP, and by extension SMTP. That is a real limit, not an oversight, and it is worth knowing before you sign up: WireGuard, most game servers other than Minecraft Java, and Minecraft Bedrock all need UDP and will not work here. Saying so is cheaper for both of us than finding out later.
TLS is negotiated per connection: TLS 1.3 where the visitor's client supports it, TLS 1.2 as the floor, terminated at our edge. Certificates for the managed *.tunnels.host addresses are already in place, and if you bring your own domain the certificate is issued for you once you point a CNAME at us.
More on the TCP side: SSH access and database access. On the HTTP side: HTTP vs HTTPS tunnels.
Frequently asked questions
Is there a free plan, and what does it include?
Yes. The free plan costs nothing, needs no credit card, and gives you one tunnel at a time, 4 GB of bandwidth a month and a sustained rate of 1,024 requests per second. It covers HTTPS tunnels, which is what webhooks, demos and device testing need. It does not include raw TCP or a subdomain you choose.
Does my URL stay the same when I restart?
Not on the free plan. Free and Student tunnels get a randomly generated 16-character subdomain that is reassigned each time. A reserved subdomain, which does keep the same address across restarts, starts on the Professional plan at $4 a month. That matters most for webhooks, because the URL you registered with a provider has to keep working.
Can I tunnel SSH, a database or remote desktop?
Yes, over a raw TCP tunnel, which starts on the Professional plan at $4 a month. The free and Student plans are HTTPS only. UDP is not supported on any plan, so WireGuard and Minecraft Bedrock will not work.
Which platforms is the client available for?
There are eleven published builds: Linux on amd64, arm64, 386 and armv7; macOS on Intel and Apple silicon; Windows on amd64, 386 and arm64; plus FreeBSD and NetBSD on amd64. The armv7 and arm64 builds are what make a Raspberry Pi work. The client is written in Rust and the macOS build is under 5 MB.
Can I use my own domain?
Yes, from the Gold plan. You point a CNAME at us and the certificate is issued for you. Below that, the Professional plan gives you up to three reserved subdomains on our domain, and the free plan gives you a random one.
Can I run the server myself?
No. tunnels.io is a hosted service. The client runs on your machine and the edge that accepts public traffic is ours. If self-hosting the whole path is a requirement, a tunnel service is the wrong shape of tool for you and we would rather say so.
Start here
New to this: the setup walkthrough takes you from nothing to a working public URL. Deciding on a plan: pricing shows every limit side by side. Already installed: the documentation covers the flags, the config file and the API, and downloads has signed builds for every platform. Curious how any of it works: the explanations.
Ship your localhost to the world.
Start free, no credit card. Upgrade when you need more.